diff mbox series

[scarthgap,14/37] iptables: fix save/restore symlinks with libnftnl PACKAGECONFIG enabled

Message ID 2c0d03ed7bb9c17b1c3ccefd00bf3a4ede9e291f.1722258106.git.steve@sakoman.com
State Accepted
Delegated to: Steve Sakoman
Headers show
Series [scarthgap,01/37] ofono: fix CVE-2023-2794 | expand

Commit Message

Steve Sakoman July 29, 2024, 1:12 p.m. UTC 
From: Kirill Yatsenko <kiriyatsenko@gmail.com>

When the libnftnl PACKAGECONFIG is enabled, the "iptables" symlink is correctly
points to xtables-nft-multi, however the "iptables-save" and
"iptables-restore" are still point to the xtables-legacy-multi.

So, when the "iptables" command is used it's using the nftables backend
where is the "iptables-save/restore" are using the legacy backend.

This is not consistent with other distros (e.g. Ubuntu).

The issue was identified when testing the UFW firewall with nftables backend.

Signed-off-by: Kirill Yatsenko <kiriyatsenko@gmail.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(cherry picked from commit 6579e4333b74232d8b576c399eab88e37da881ac)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 meta/recipes-extended/iptables/iptables_1.8.10.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-extended/iptables/iptables_1.8.10.bb b/meta/recipes-extended/iptables/iptables_1.8.10.bb
index cd2f3bce0b..0070264844 100644
--- a/meta/recipes-extended/iptables/iptables_1.8.10.bb
+++ b/meta/recipes-extended/iptables/iptables_1.8.10.bb
@@ -75,6 +75,8 @@  do_install:append() {
     # if libnftnl is included, make the iptables symlink point to the nft-based binary by default
     if ${@bb.utils.contains('PACKAGECONFIG', 'libnftnl', 'true', 'false', d)} ; then
         ln -sf ${sbindir}/xtables-nft-multi ${D}${sbindir}/iptables 
+        ln -sf ${sbindir}/xtables-nft-multi ${D}${sbindir}/iptables-save
+        ln -sf ${sbindir}/xtables-nft-multi ${D}${sbindir}/iptables-restore
     fi
 }